3 ms·

I don't think anyone but the most uninformed would argue that fail2ban is an actual secure measure, it's more of a log file annoyance reducer. Obviously if you

I don't think anyone but the most uninformed would argue that fail2ban is an actual secure measure, it's more of a log file annoyance reducer. Obviously if you leave remote root enabled and the root password is one of a few dozen thousand common words that exist out there in public-domain password data sets, fail2ban isn't going to help much. As with the example of all the random botnet things out there that randomly try a popular list of dozens of common usernames (admin, root, webmaster, etc) with common passwords. With things other than SSH it can also be effective in the most rudimentary first level filtering out of spam, various things that attempt to relay mail through my server get themselves first banned, and then banned for a longer time after they keep re-trying. Again with primarily the goal of having less cluttered postfix logs.

behringer 5y ago
Fail2ban is also useful if you do leave something misconfigured. Mistakes happen so having a little redundancy is OK.
- tptacek 5y ago
  Apply your redundancy to whatever is generating and safeguarding your SSH configurations.
  - behringer 5y ago
    What does this even mean? I'm the one who generates the ssh configuration for my computer clubs server...
lamontcg 5y ago
fail2ban is the same as having high number of rounds on password hashes to slow down attackers, and it takes about 30 seconds to install+configure. it makes a lot more sense than the title here, but is only useful as security-in-depth and can't replace other good practices. high rounds on a password hash is also equally useless if you use "password123" or something like that. i've also seen significant reductions in idle cpu by using it and sending offenders to the timeout bin for 24h. thanks for calling me "most uninformed" though.
- walrus01 5y ago
  I wasn't calling you most uninformed, your statement is totally correct, I was referring to any persons who might argue that fail2ban is purely useless as security theater. What I said was that fail2ban is useful as an annoyance/log clutter reducer, but not something that's an actual security measure which would be suitable to protect a poorly-configured sshd.

behringer 5y ago

Fail2ban is also useful if you do leave something misconfigured. Mistakes happen so having a little redundancy is OK.

tptacek 5y ago
Apply your redundancy to whatever is generating and safeguarding your SSH configurations.
- behringer 5y ago
  What does this even mean? I'm the one who generates the ssh configuration for my computer clubs server...

lamontcg 5y ago

fail2ban is the same as having high number of rounds on password hashes to slow down attackers, and it takes about 30 seconds to install+configure. it makes a lot more sense than the title here, but is only useful as security-in-depth and can't replace other good practices. high rounds on a password hash is also equally useless if you use "password123" or something like that. i've also seen significant reductions in idle cpu by using it and sending offenders to the timeout bin for 24h. thanks for calling me "most uninformed" though.

walrus01 5y ago
I wasn't calling you most uninformed, your statement is totally correct, I was referring to any persons who might argue that fail2ban is purely useless as security theater. What I said was that fail2ban is useful as an annoyance/log clutter reducer, but not something that's an actual security measure which would be suitable to protect a poorly-configured sshd.